NEWS

Privacy Shield: Brace Yourself, Changes are Coming

08.10.2018

Since the application of the GDPR, the days of the EU-U.S. Privacy Shield may be numbered and parties to an IT contract must be on the alert.

Although adopted three months after the GDPR, the Privacy Shield (1), which is designed to regulate the flow of personal data between the European Union and the United States of America, has already come under scrutiny: it was first evaluated by the European Commission in October 2017 (2), then by the European Parliament (3) and recently by the Commissioner for Justice, Consumers and Gender Equality, Věra Jourová (4). Its future is uncertain and in the meantime, the parties to an IT contract providing for transatlantic data flows will have to prepare for any scenario and already anticipate its disappearance.

The position of the European Parliament on the EU-U.S. Privacy Shield

Drawing on the Commission’s findings of October 2017, the European Parliament filed a motion for a resolution in which it noted that the recommendations made at that time had not been followed up by the U.S. administration.

The Commission indeed wanted the system to be improved and recommended in particular to appoint a Privacy Shield Ombudsperson who would act as general supervisor and mediator in the implementation of the obligations under the Privacy Shield, and to promote closer cooperation between administrative and judicial authorities on both sides of the Atlantic.

The EU-U.S. Privacy Shield thus passed the Commission’s test, but the U.S. administration only response to those requests for improvement was to:

adopt the CLOUD Act to facilitate access to personal data of “American persons” even if the data is physically hosted in Europe (4);

Expressing its concerns, the Parliament invited the Commission to suspend the application of the Privacy Shield with effect from 1 September 2018, absent immediate reaction from the American authorities. This suspension eventually did not occur because the Parliament’s resolution has no binding force. The Commission later reacted through Commissioner Věra Jourová.

The position of the Commissioner in charge of the EU-U.S. Privacy Shield

The Commissioner in charge of digital technology heard the Parliament’s message and said that the appointment of the Ombudsman was a conditio sine qua non for maintaining the EU-U.S. Privacy Shield.

But the Commissioner did not endorse the other requirements laid down in Parliament’s resolution, as it was observed that, however imperfect its implementation may be, the rights of European citizens would be even weaker without the Privacy Shield than with it.

The Ombudsman would play a pivotal role as the European user’s contact point: he or she will be in charge of dealing with complaints concerning the application of Privacy Shield. A solution from the U.S. administration is expected by 18 October 2018, date on which the European Commission will submit its annual evaluation report, according to statements made in the Financial Times. Otherwise, a suspension of the Privacy Shield is possible.

Amid the Privacy Shield crisis, the Commission also intends to focus on another area: combating the misuse of the purpose of personal data processing, in particular for political purposes. The Commission sets sights on data breaches, in the wake of the famous Facebook-Cambridge Analytica data scandal. In these cases, the maximum fine provided for in the GDPR at 4% of the world’s annual turnover would be increased to 5%.

Possible actions in case of disappearance of the EU-U.S. Privacy Shield

The disappearance of the Safe Harbor by judgment of the Court of Justice of the European Union at the end of 2015 left its mark (5). Now, the parties to an IT contract covered by the Privacy Shield should be extra cautious, even if the EU-U.S. Privacy Shield still applies: an increasingly common practice is to take the precaution of mentioning in the contract that the parties undertake in advance to comply with any future agreement that may replace the Privacy Shield.

In case the Privacy Shield is not immediately replaced by another text, the parties may turn to other solutions such as:

Binding Corporates Rules (BCR) for intra-group contracts,

the standard contractual clauses proposed by the European Commission, or

Transatlantic data transfers are essential for the economic activity of many businesses; they are therefore strongly advised to be careful, prepare for any situation, and adopt a ‘better safe than sorry’ approach.

Who Are We?

StarAudit is a global program - provided by EuroCloud Europe - with an international network of accredited partners and professionals. EuroCloud Europe is an independent non-profit organisation (www.eurocloud.org).